Ransomware vs DDoS

83% of organizations fell victim to a successful ransomware attack in the last 24 months, up from 66% in 2024.

Of organizations hit by ransomware, 75% experience multiple service interruptions.

Only 39% of organizations recover at least 75% of their data after a ransomware attack, down from 57% in 2024.

Twelve vulnerabilities carry confirmed "multi-nexus" attribution, being independently exploited across five distinct threat categories (China, Russia, DPRK, Iran-nexus, and criminal actors).

More than half of mid-market ransomware victims generate less than $50M in annual revenue.

Mid-market organizations accounted for approximately 72–75% of ransomware victims each year.

Compromised credentials accounted for 67% of ransomware intrusions investigated by Beazley Security, down from 74% in Q1.

Public ransomware leak-site postings totaled 2,268, remaining nearly 60% above Q2 2025.

73% of ransomware attacks in North America and Europe hit companies with $10M to $1B in annual revenue from 2023 through the first half of 2026.

27% of healthcare organizations cite cybersecurity threats and ransomware as the #1 network challenge, 23% cite staffing shortages and lack of expertise, 20% cite rising operational and compliance costs, 16% cite network reliability impacting clinical systems, and 15% cite aging or fragmented infrastructure.

Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.

Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.

Ransomware remained the most persistent and disruptive cyber threat to industrial organizations in Q2 2026

Manufacturing was the most affected sector by ransomware incidents affecting industrial organizations worldwide, with 747 incidents (65%) across all subsectors in Q2 2026.

The number of DDoS attacks on the Link11 network decreased by 42% in the first half of 2026 compared to the first half of 2025.

The highest measured DDoS bandwidth reached 2.3 Tbit/s, 85% higher than the previous peak of 1.2 Tbit/s in the first half of 2025.

DDoS packet rate peaked at 322 million packets per second, up 56% from 207 million packets per second a year earlier.

DNS-based attacks accounted for 34.3% of network-layer attacks in the first half of 2026.

CLDAP Floods surged 580% quarter-over-quarter and became the #3 attack vector in Q2 2026.

April 2026 peaked at 6.46 trillion HTTP DDoS requests and 165 petabytes of volume.

4% of reported cybercrime cases in Africa in 2025 involved DDoS attacks.

5% of Nordic CISOs cited DDoS and opportunistic probing as their primary concern.

Peak DDoS attack sizes increased by 262% year over year, with terabit-scale attacks occurring in seconds.

More than 90% of DDoS attacks last less than 10 minutes.

Six-second pulse DDoS attacks eliminate the window for reactive intervention.

Botnets leveraged more than 500,000 compromised systems to power DDoS campaigns.

Distributed denial-of-service campaigns reached a peak of 31.4 Tbps.

75% of network-layer DDoS attacks last less than one minute.

64% of application-layer DDoS attacks exceed 10 minutes.